1b5e95b48SJohn Johansen /* 2b5e95b48SJohn Johansen * AppArmor security module 3b5e95b48SJohn Johansen * 4b5e95b48SJohn Johansen * This file contains AppArmor LSM hooks. 5b5e95b48SJohn Johansen * 6b5e95b48SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE 7b5e95b48SJohn Johansen * Copyright 2009-2010 Canonical Ltd. 8b5e95b48SJohn Johansen * 9b5e95b48SJohn Johansen * This program is free software; you can redistribute it and/or 10b5e95b48SJohn Johansen * modify it under the terms of the GNU General Public License as 11b5e95b48SJohn Johansen * published by the Free Software Foundation, version 2 of the 12b5e95b48SJohn Johansen * License. 13b5e95b48SJohn Johansen */ 14b5e95b48SJohn Johansen 153c4ed7bdSCasey Schaufler #include <linux/lsm_hooks.h> 16b5e95b48SJohn Johansen #include <linux/moduleparam.h> 17b5e95b48SJohn Johansen #include <linux/mm.h> 18b5e95b48SJohn Johansen #include <linux/mman.h> 19b5e95b48SJohn Johansen #include <linux/mount.h> 20b5e95b48SJohn Johansen #include <linux/namei.h> 21b5e95b48SJohn Johansen #include <linux/ptrace.h> 22b5e95b48SJohn Johansen #include <linux/ctype.h> 23b5e95b48SJohn Johansen #include <linux/sysctl.h> 24b5e95b48SJohn Johansen #include <linux/audit.h> 253486740aSSerge E. Hallyn #include <linux/user_namespace.h> 26b5e95b48SJohn Johansen #include <net/sock.h> 27b5e95b48SJohn Johansen 28b5e95b48SJohn Johansen #include "include/apparmor.h" 29b5e95b48SJohn Johansen #include "include/apparmorfs.h" 30b5e95b48SJohn Johansen #include "include/audit.h" 31b5e95b48SJohn Johansen #include "include/capability.h" 32b5e95b48SJohn Johansen #include "include/context.h" 33b5e95b48SJohn Johansen #include "include/file.h" 34b5e95b48SJohn Johansen #include "include/ipc.h" 35b5e95b48SJohn Johansen #include "include/path.h" 36b5e95b48SJohn Johansen #include "include/policy.h" 37b5e95b48SJohn Johansen #include "include/procattr.h" 38b5e95b48SJohn Johansen 39b5e95b48SJohn Johansen /* Flag indicating whether initialization completed */ 40b5e95b48SJohn Johansen int apparmor_initialized __initdata; 41b5e95b48SJohn Johansen 42b5e95b48SJohn Johansen /* 43b5e95b48SJohn Johansen * LSM hook functions 44b5e95b48SJohn Johansen */ 45b5e95b48SJohn Johansen 46b5e95b48SJohn Johansen /* 47b5e95b48SJohn Johansen * free the associated aa_task_cxt and put its profiles 48b5e95b48SJohn Johansen */ 49b5e95b48SJohn Johansen static void apparmor_cred_free(struct cred *cred) 50b5e95b48SJohn Johansen { 51214beacaSJohn Johansen aa_free_task_context(cred_cxt(cred)); 52214beacaSJohn Johansen cred_cxt(cred) = NULL; 53b5e95b48SJohn Johansen } 54b5e95b48SJohn Johansen 55b5e95b48SJohn Johansen /* 56b5e95b48SJohn Johansen * allocate the apparmor part of blank credentials 57b5e95b48SJohn Johansen */ 58b5e95b48SJohn Johansen static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) 59b5e95b48SJohn Johansen { 60b5e95b48SJohn Johansen /* freed by apparmor_cred_free */ 61b5e95b48SJohn Johansen struct aa_task_cxt *cxt = aa_alloc_task_context(gfp); 62b5e95b48SJohn Johansen if (!cxt) 63b5e95b48SJohn Johansen return -ENOMEM; 64b5e95b48SJohn Johansen 65214beacaSJohn Johansen cred_cxt(cred) = cxt; 66b5e95b48SJohn Johansen return 0; 67b5e95b48SJohn Johansen } 68b5e95b48SJohn Johansen 69b5e95b48SJohn Johansen /* 70b5e95b48SJohn Johansen * prepare new aa_task_cxt for modification by prepare_cred block 71b5e95b48SJohn Johansen */ 72b5e95b48SJohn Johansen static int apparmor_cred_prepare(struct cred *new, const struct cred *old, 73b5e95b48SJohn Johansen gfp_t gfp) 74b5e95b48SJohn Johansen { 75b5e95b48SJohn Johansen /* freed by apparmor_cred_free */ 76b5e95b48SJohn Johansen struct aa_task_cxt *cxt = aa_alloc_task_context(gfp); 77b5e95b48SJohn Johansen if (!cxt) 78b5e95b48SJohn Johansen return -ENOMEM; 79b5e95b48SJohn Johansen 80214beacaSJohn Johansen aa_dup_task_context(cxt, cred_cxt(old)); 81214beacaSJohn Johansen cred_cxt(new) = cxt; 82b5e95b48SJohn Johansen return 0; 83b5e95b48SJohn Johansen } 84b5e95b48SJohn Johansen 85b5e95b48SJohn Johansen /* 86b5e95b48SJohn Johansen * transfer the apparmor data to a blank set of creds 87b5e95b48SJohn Johansen */ 88b5e95b48SJohn Johansen static void apparmor_cred_transfer(struct cred *new, const struct cred *old) 89b5e95b48SJohn Johansen { 90214beacaSJohn Johansen const struct aa_task_cxt *old_cxt = cred_cxt(old); 91214beacaSJohn Johansen struct aa_task_cxt *new_cxt = cred_cxt(new); 92b5e95b48SJohn Johansen 93b5e95b48SJohn Johansen aa_dup_task_context(new_cxt, old_cxt); 94b5e95b48SJohn Johansen } 95b5e95b48SJohn Johansen 96b5e95b48SJohn Johansen static int apparmor_ptrace_access_check(struct task_struct *child, 97b5e95b48SJohn Johansen unsigned int mode) 98b5e95b48SJohn Johansen { 99b5e95b48SJohn Johansen return aa_ptrace(current, child, mode); 100b5e95b48SJohn Johansen } 101b5e95b48SJohn Johansen 102b5e95b48SJohn Johansen static int apparmor_ptrace_traceme(struct task_struct *parent) 103b5e95b48SJohn Johansen { 104b5e95b48SJohn Johansen return aa_ptrace(parent, current, PTRACE_MODE_ATTACH); 105b5e95b48SJohn Johansen } 106b5e95b48SJohn Johansen 107b5e95b48SJohn Johansen /* Derived from security/commoncap.c:cap_capget */ 108b5e95b48SJohn Johansen static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective, 109b5e95b48SJohn Johansen kernel_cap_t *inheritable, kernel_cap_t *permitted) 110b5e95b48SJohn Johansen { 111b5e95b48SJohn Johansen struct aa_profile *profile; 112b5e95b48SJohn Johansen const struct cred *cred; 113b5e95b48SJohn Johansen 114b5e95b48SJohn Johansen rcu_read_lock(); 115b5e95b48SJohn Johansen cred = __task_cred(target); 116b5e95b48SJohn Johansen profile = aa_cred_profile(cred); 117b5e95b48SJohn Johansen 118b1d9e6b0SCasey Schaufler /* 119b1d9e6b0SCasey Schaufler * cap_capget is stacked ahead of this and will 120b1d9e6b0SCasey Schaufler * initialize effective and permitted. 121b1d9e6b0SCasey Schaufler */ 12225e75dffSJohn Johansen if (!unconfined(profile) && !COMPLAIN_MODE(profile)) { 123b5e95b48SJohn Johansen *effective = cap_intersect(*effective, profile->caps.allow); 124b5e95b48SJohn Johansen *permitted = cap_intersect(*permitted, profile->caps.allow); 125b5e95b48SJohn Johansen } 126b5e95b48SJohn Johansen rcu_read_unlock(); 127b5e95b48SJohn Johansen 128b5e95b48SJohn Johansen return 0; 129b5e95b48SJohn Johansen } 130b5e95b48SJohn Johansen 1316a9de491SEric Paris static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, 1326a9de491SEric Paris int cap, int audit) 133b5e95b48SJohn Johansen { 134b5e95b48SJohn Johansen struct aa_profile *profile; 135b1d9e6b0SCasey Schaufler int error = 0; 136b1d9e6b0SCasey Schaufler 137b5e95b48SJohn Johansen profile = aa_cred_profile(cred); 138b5e95b48SJohn Johansen if (!unconfined(profile)) 139dd0c6e86SJohn Johansen error = aa_capable(profile, cap, audit); 140b5e95b48SJohn Johansen return error; 141b5e95b48SJohn Johansen } 142b5e95b48SJohn Johansen 143b5e95b48SJohn Johansen /** 144b5e95b48SJohn Johansen * common_perm - basic common permission check wrapper fn for paths 145b5e95b48SJohn Johansen * @op: operation being checked 146b5e95b48SJohn Johansen * @path: path to check permission of (NOT NULL) 147b5e95b48SJohn Johansen * @mask: requested permissions mask 148b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 149b5e95b48SJohn Johansen * 150b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 151b5e95b48SJohn Johansen */ 152*2c7661ffSAl Viro static int common_perm(int op, const struct path *path, u32 mask, 153b5e95b48SJohn Johansen struct path_cond *cond) 154b5e95b48SJohn Johansen { 155b5e95b48SJohn Johansen struct aa_profile *profile; 156b5e95b48SJohn Johansen int error = 0; 157b5e95b48SJohn Johansen 158b5e95b48SJohn Johansen profile = __aa_current_profile(); 159b5e95b48SJohn Johansen if (!unconfined(profile)) 160b5e95b48SJohn Johansen error = aa_path_perm(op, profile, path, 0, mask, cond); 161b5e95b48SJohn Johansen 162b5e95b48SJohn Johansen return error; 163b5e95b48SJohn Johansen } 164b5e95b48SJohn Johansen 165b5e95b48SJohn Johansen /** 166b5e95b48SJohn Johansen * common_perm_dir_dentry - common permission wrapper when path is dir, dentry 167b5e95b48SJohn Johansen * @op: operation being checked 168b5e95b48SJohn Johansen * @dir: directory of the dentry (NOT NULL) 169b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 170b5e95b48SJohn Johansen * @mask: requested permissions mask 171b5e95b48SJohn Johansen * @cond: conditional info for the permission request (NOT NULL) 172b5e95b48SJohn Johansen * 173b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 174b5e95b48SJohn Johansen */ 175b5e95b48SJohn Johansen static int common_perm_dir_dentry(int op, struct path *dir, 176b5e95b48SJohn Johansen struct dentry *dentry, u32 mask, 177b5e95b48SJohn Johansen struct path_cond *cond) 178b5e95b48SJohn Johansen { 179b5e95b48SJohn Johansen struct path path = { dir->mnt, dentry }; 180b5e95b48SJohn Johansen 181b5e95b48SJohn Johansen return common_perm(op, &path, mask, cond); 182b5e95b48SJohn Johansen } 183b5e95b48SJohn Johansen 184b5e95b48SJohn Johansen /** 185b5e95b48SJohn Johansen * common_perm_mnt_dentry - common permission wrapper when mnt, dentry 186b5e95b48SJohn Johansen * @op: operation being checked 187b5e95b48SJohn Johansen * @mnt: mount point of dentry (NOT NULL) 188b5e95b48SJohn Johansen * @dentry: dentry to check (NOT NULL) 189b5e95b48SJohn Johansen * @mask: requested permissions mask 190b5e95b48SJohn Johansen * 191b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 192b5e95b48SJohn Johansen */ 193b5e95b48SJohn Johansen static int common_perm_mnt_dentry(int op, struct vfsmount *mnt, 194b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 195b5e95b48SJohn Johansen { 196b5e95b48SJohn Johansen struct path path = { mnt, dentry }; 197c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(dentry)->i_uid, 198c6f493d6SDavid Howells d_backing_inode(dentry)->i_mode 199b5e95b48SJohn Johansen }; 200b5e95b48SJohn Johansen 201b5e95b48SJohn Johansen return common_perm(op, &path, mask, &cond); 202b5e95b48SJohn Johansen } 203b5e95b48SJohn Johansen 204b5e95b48SJohn Johansen /** 205b5e95b48SJohn Johansen * common_perm_rm - common permission wrapper for operations doing rm 206b5e95b48SJohn Johansen * @op: operation being checked 207b5e95b48SJohn Johansen * @dir: directory that the dentry is in (NOT NULL) 208b5e95b48SJohn Johansen * @dentry: dentry being rm'd (NOT NULL) 209b5e95b48SJohn Johansen * @mask: requested permission mask 210b5e95b48SJohn Johansen * 211b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 212b5e95b48SJohn Johansen */ 213b5e95b48SJohn Johansen static int common_perm_rm(int op, struct path *dir, 214b5e95b48SJohn Johansen struct dentry *dentry, u32 mask) 215b5e95b48SJohn Johansen { 216c6f493d6SDavid Howells struct inode *inode = d_backing_inode(dentry); 217b5e95b48SJohn Johansen struct path_cond cond = { }; 218b5e95b48SJohn Johansen 2197ac2856dSDavid Howells if (!inode || !dir->mnt || !mediated_filesystem(dentry)) 220b5e95b48SJohn Johansen return 0; 221b5e95b48SJohn Johansen 222b5e95b48SJohn Johansen cond.uid = inode->i_uid; 223b5e95b48SJohn Johansen cond.mode = inode->i_mode; 224b5e95b48SJohn Johansen 225b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 226b5e95b48SJohn Johansen } 227b5e95b48SJohn Johansen 228b5e95b48SJohn Johansen /** 229b5e95b48SJohn Johansen * common_perm_create - common permission wrapper for operations doing create 230b5e95b48SJohn Johansen * @op: operation being checked 231b5e95b48SJohn Johansen * @dir: directory that dentry will be created in (NOT NULL) 232b5e95b48SJohn Johansen * @dentry: dentry to create (NOT NULL) 233b5e95b48SJohn Johansen * @mask: request permission mask 234b5e95b48SJohn Johansen * @mode: created file mode 235b5e95b48SJohn Johansen * 236b5e95b48SJohn Johansen * Returns: %0 else error code if error or permission denied 237b5e95b48SJohn Johansen */ 238b5e95b48SJohn Johansen static int common_perm_create(int op, struct path *dir, struct dentry *dentry, 239b5e95b48SJohn Johansen u32 mask, umode_t mode) 240b5e95b48SJohn Johansen { 241b5e95b48SJohn Johansen struct path_cond cond = { current_fsuid(), mode }; 242b5e95b48SJohn Johansen 2437ac2856dSDavid Howells if (!dir->mnt || !mediated_filesystem(dir->dentry)) 244b5e95b48SJohn Johansen return 0; 245b5e95b48SJohn Johansen 246b5e95b48SJohn Johansen return common_perm_dir_dentry(op, dir, dentry, mask, &cond); 247b5e95b48SJohn Johansen } 248b5e95b48SJohn Johansen 249b5e95b48SJohn Johansen static int apparmor_path_unlink(struct path *dir, struct dentry *dentry) 250b5e95b48SJohn Johansen { 251b5e95b48SJohn Johansen return common_perm_rm(OP_UNLINK, dir, dentry, AA_MAY_DELETE); 252b5e95b48SJohn Johansen } 253b5e95b48SJohn Johansen 254b5e95b48SJohn Johansen static int apparmor_path_mkdir(struct path *dir, struct dentry *dentry, 2554572befeSAl Viro umode_t mode) 256b5e95b48SJohn Johansen { 257b5e95b48SJohn Johansen return common_perm_create(OP_MKDIR, dir, dentry, AA_MAY_CREATE, 258b5e95b48SJohn Johansen S_IFDIR); 259b5e95b48SJohn Johansen } 260b5e95b48SJohn Johansen 261b5e95b48SJohn Johansen static int apparmor_path_rmdir(struct path *dir, struct dentry *dentry) 262b5e95b48SJohn Johansen { 263b5e95b48SJohn Johansen return common_perm_rm(OP_RMDIR, dir, dentry, AA_MAY_DELETE); 264b5e95b48SJohn Johansen } 265b5e95b48SJohn Johansen 266b5e95b48SJohn Johansen static int apparmor_path_mknod(struct path *dir, struct dentry *dentry, 26704fc66e7SAl Viro umode_t mode, unsigned int dev) 268b5e95b48SJohn Johansen { 269b5e95b48SJohn Johansen return common_perm_create(OP_MKNOD, dir, dentry, AA_MAY_CREATE, mode); 270b5e95b48SJohn Johansen } 271b5e95b48SJohn Johansen 2724d6ec10bSJames Morris static int apparmor_path_truncate(struct path *path) 273b5e95b48SJohn Johansen { 274c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(path->dentry)->i_uid, 275c6f493d6SDavid Howells d_backing_inode(path->dentry)->i_mode 276b5e95b48SJohn Johansen }; 277b5e95b48SJohn Johansen 2787ac2856dSDavid Howells if (!path->mnt || !mediated_filesystem(path->dentry)) 279b5e95b48SJohn Johansen return 0; 280b5e95b48SJohn Johansen 281b5e95b48SJohn Johansen return common_perm(OP_TRUNC, path, MAY_WRITE | AA_MAY_META_WRITE, 282b5e95b48SJohn Johansen &cond); 283b5e95b48SJohn Johansen } 284b5e95b48SJohn Johansen 285b5e95b48SJohn Johansen static int apparmor_path_symlink(struct path *dir, struct dentry *dentry, 286b5e95b48SJohn Johansen const char *old_name) 287b5e95b48SJohn Johansen { 288b5e95b48SJohn Johansen return common_perm_create(OP_SYMLINK, dir, dentry, AA_MAY_CREATE, 289b5e95b48SJohn Johansen S_IFLNK); 290b5e95b48SJohn Johansen } 291b5e95b48SJohn Johansen 292b5e95b48SJohn Johansen static int apparmor_path_link(struct dentry *old_dentry, struct path *new_dir, 293b5e95b48SJohn Johansen struct dentry *new_dentry) 294b5e95b48SJohn Johansen { 295b5e95b48SJohn Johansen struct aa_profile *profile; 296b5e95b48SJohn Johansen int error = 0; 297b5e95b48SJohn Johansen 2987ac2856dSDavid Howells if (!mediated_filesystem(old_dentry)) 299b5e95b48SJohn Johansen return 0; 300b5e95b48SJohn Johansen 301b5e95b48SJohn Johansen profile = aa_current_profile(); 302b5e95b48SJohn Johansen if (!unconfined(profile)) 303b5e95b48SJohn Johansen error = aa_path_link(profile, old_dentry, new_dir, new_dentry); 304b5e95b48SJohn Johansen return error; 305b5e95b48SJohn Johansen } 306b5e95b48SJohn Johansen 307b5e95b48SJohn Johansen static int apparmor_path_rename(struct path *old_dir, struct dentry *old_dentry, 308b5e95b48SJohn Johansen struct path *new_dir, struct dentry *new_dentry) 309b5e95b48SJohn Johansen { 310b5e95b48SJohn Johansen struct aa_profile *profile; 311b5e95b48SJohn Johansen int error = 0; 312b5e95b48SJohn Johansen 3137ac2856dSDavid Howells if (!mediated_filesystem(old_dentry)) 314b5e95b48SJohn Johansen return 0; 315b5e95b48SJohn Johansen 316b5e95b48SJohn Johansen profile = aa_current_profile(); 317b5e95b48SJohn Johansen if (!unconfined(profile)) { 318b5e95b48SJohn Johansen struct path old_path = { old_dir->mnt, old_dentry }; 319b5e95b48SJohn Johansen struct path new_path = { new_dir->mnt, new_dentry }; 320c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(old_dentry)->i_uid, 321c6f493d6SDavid Howells d_backing_inode(old_dentry)->i_mode 322b5e95b48SJohn Johansen }; 323b5e95b48SJohn Johansen 324b5e95b48SJohn Johansen error = aa_path_perm(OP_RENAME_SRC, profile, &old_path, 0, 325b5e95b48SJohn Johansen MAY_READ | AA_MAY_META_READ | MAY_WRITE | 326b5e95b48SJohn Johansen AA_MAY_META_WRITE | AA_MAY_DELETE, 327b5e95b48SJohn Johansen &cond); 328b5e95b48SJohn Johansen if (!error) 329b5e95b48SJohn Johansen error = aa_path_perm(OP_RENAME_DEST, profile, &new_path, 330b5e95b48SJohn Johansen 0, MAY_WRITE | AA_MAY_META_WRITE | 331b5e95b48SJohn Johansen AA_MAY_CREATE, &cond); 332b5e95b48SJohn Johansen 333b5e95b48SJohn Johansen } 334b5e95b48SJohn Johansen return error; 335b5e95b48SJohn Johansen } 336b5e95b48SJohn Johansen 337cdcf116dSAl Viro static int apparmor_path_chmod(struct path *path, umode_t mode) 338b5e95b48SJohn Johansen { 3397ac2856dSDavid Howells if (!mediated_filesystem(path->dentry)) 340b5e95b48SJohn Johansen return 0; 341b5e95b48SJohn Johansen 342cdcf116dSAl Viro return common_perm_mnt_dentry(OP_CHMOD, path->mnt, path->dentry, AA_MAY_CHMOD); 343b5e95b48SJohn Johansen } 344b5e95b48SJohn Johansen 345d2b31ca6SEric W. Biederman static int apparmor_path_chown(struct path *path, kuid_t uid, kgid_t gid) 346b5e95b48SJohn Johansen { 347c6f493d6SDavid Howells struct path_cond cond = { d_backing_inode(path->dentry)->i_uid, 348c6f493d6SDavid Howells d_backing_inode(path->dentry)->i_mode 349b5e95b48SJohn Johansen }; 350b5e95b48SJohn Johansen 3517ac2856dSDavid Howells if (!mediated_filesystem(path->dentry)) 352b5e95b48SJohn Johansen return 0; 353b5e95b48SJohn Johansen 354b5e95b48SJohn Johansen return common_perm(OP_CHOWN, path, AA_MAY_CHOWN, &cond); 355b5e95b48SJohn Johansen } 356b5e95b48SJohn Johansen 3573f7036a0SAl Viro static int apparmor_inode_getattr(const struct path *path) 358b5e95b48SJohn Johansen { 3593f7036a0SAl Viro if (!mediated_filesystem(path->dentry)) 360b5e95b48SJohn Johansen return 0; 361b5e95b48SJohn Johansen 3623f7036a0SAl Viro return common_perm_mnt_dentry(OP_GETATTR, path->mnt, path->dentry, 363b5e95b48SJohn Johansen AA_MAY_META_READ); 364b5e95b48SJohn Johansen } 365b5e95b48SJohn Johansen 36683d49856SEric Paris static int apparmor_file_open(struct file *file, const struct cred *cred) 367b5e95b48SJohn Johansen { 368b5e95b48SJohn Johansen struct aa_file_cxt *fcxt = file->f_security; 369b5e95b48SJohn Johansen struct aa_profile *profile; 370b5e95b48SJohn Johansen int error = 0; 371b5e95b48SJohn Johansen 3727ac2856dSDavid Howells if (!mediated_filesystem(file->f_path.dentry)) 373b5e95b48SJohn Johansen return 0; 374b5e95b48SJohn Johansen 375b5e95b48SJohn Johansen /* If in exec, permission is handled by bprm hooks. 376b5e95b48SJohn Johansen * Cache permissions granted by the previous exec check, with 377b5e95b48SJohn Johansen * implicit read and executable mmap which are required to 378b5e95b48SJohn Johansen * actually execute the image. 379b5e95b48SJohn Johansen */ 380b5e95b48SJohn Johansen if (current->in_execve) { 381b5e95b48SJohn Johansen fcxt->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; 382b5e95b48SJohn Johansen return 0; 383b5e95b48SJohn Johansen } 384b5e95b48SJohn Johansen 385b5e95b48SJohn Johansen profile = aa_cred_profile(cred); 386b5e95b48SJohn Johansen if (!unconfined(profile)) { 387496ad9aaSAl Viro struct inode *inode = file_inode(file); 388b5e95b48SJohn Johansen struct path_cond cond = { inode->i_uid, inode->i_mode }; 389b5e95b48SJohn Johansen 390b5e95b48SJohn Johansen error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0, 391b5e95b48SJohn Johansen aa_map_file_to_perms(file), &cond); 392b5e95b48SJohn Johansen /* todo cache full allowed permissions set and state */ 393b5e95b48SJohn Johansen fcxt->allow = aa_map_file_to_perms(file); 394b5e95b48SJohn Johansen } 395b5e95b48SJohn Johansen 396b5e95b48SJohn Johansen return error; 397b5e95b48SJohn Johansen } 398b5e95b48SJohn Johansen 399b5e95b48SJohn Johansen static int apparmor_file_alloc_security(struct file *file) 400b5e95b48SJohn Johansen { 401b5e95b48SJohn Johansen /* freed by apparmor_file_free_security */ 402b5e95b48SJohn Johansen file->f_security = aa_alloc_file_context(GFP_KERNEL); 403b5e95b48SJohn Johansen if (!file->f_security) 404b5e95b48SJohn Johansen return -ENOMEM; 405b5e95b48SJohn Johansen return 0; 406b5e95b48SJohn Johansen 407b5e95b48SJohn Johansen } 408b5e95b48SJohn Johansen 409b5e95b48SJohn Johansen static void apparmor_file_free_security(struct file *file) 410b5e95b48SJohn Johansen { 411b5e95b48SJohn Johansen struct aa_file_cxt *cxt = file->f_security; 412b5e95b48SJohn Johansen 413b5e95b48SJohn Johansen aa_free_file_context(cxt); 414b5e95b48SJohn Johansen } 415b5e95b48SJohn Johansen 416b5e95b48SJohn Johansen static int common_file_perm(int op, struct file *file, u32 mask) 417b5e95b48SJohn Johansen { 418b5e95b48SJohn Johansen struct aa_file_cxt *fcxt = file->f_security; 419b5e95b48SJohn Johansen struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred); 420b5e95b48SJohn Johansen int error = 0; 421b5e95b48SJohn Johansen 422b5e95b48SJohn Johansen BUG_ON(!fprofile); 423b5e95b48SJohn Johansen 424b5e95b48SJohn Johansen if (!file->f_path.mnt || 4257ac2856dSDavid Howells !mediated_filesystem(file->f_path.dentry)) 426b5e95b48SJohn Johansen return 0; 427b5e95b48SJohn Johansen 428b5e95b48SJohn Johansen profile = __aa_current_profile(); 429b5e95b48SJohn Johansen 430b5e95b48SJohn Johansen /* revalidate access, if task is unconfined, or the cached cred 431b5e95b48SJohn Johansen * doesn't match or if the request is for more permissions than 432b5e95b48SJohn Johansen * was granted. 433b5e95b48SJohn Johansen * 434b5e95b48SJohn Johansen * Note: the test for !unconfined(fprofile) is to handle file 435b5e95b48SJohn Johansen * delegation from unconfined tasks 436b5e95b48SJohn Johansen */ 437b5e95b48SJohn Johansen if (!unconfined(profile) && !unconfined(fprofile) && 438b5e95b48SJohn Johansen ((fprofile != profile) || (mask & ~fcxt->allow))) 439b5e95b48SJohn Johansen error = aa_file_perm(op, profile, file, mask); 440b5e95b48SJohn Johansen 441b5e95b48SJohn Johansen return error; 442b5e95b48SJohn Johansen } 443b5e95b48SJohn Johansen 444b5e95b48SJohn Johansen static int apparmor_file_permission(struct file *file, int mask) 445b5e95b48SJohn Johansen { 446b5e95b48SJohn Johansen return common_file_perm(OP_FPERM, file, mask); 447b5e95b48SJohn Johansen } 448b5e95b48SJohn Johansen 449b5e95b48SJohn Johansen static int apparmor_file_lock(struct file *file, unsigned int cmd) 450b5e95b48SJohn Johansen { 451b5e95b48SJohn Johansen u32 mask = AA_MAY_LOCK; 452b5e95b48SJohn Johansen 453b5e95b48SJohn Johansen if (cmd == F_WRLCK) 454b5e95b48SJohn Johansen mask |= MAY_WRITE; 455b5e95b48SJohn Johansen 456b5e95b48SJohn Johansen return common_file_perm(OP_FLOCK, file, mask); 457b5e95b48SJohn Johansen } 458b5e95b48SJohn Johansen 459b5e95b48SJohn Johansen static int common_mmap(int op, struct file *file, unsigned long prot, 460b5e95b48SJohn Johansen unsigned long flags) 461b5e95b48SJohn Johansen { 462b5e95b48SJohn Johansen int mask = 0; 463b5e95b48SJohn Johansen 464b5e95b48SJohn Johansen if (!file || !file->f_security) 465b5e95b48SJohn Johansen return 0; 466b5e95b48SJohn Johansen 467b5e95b48SJohn Johansen if (prot & PROT_READ) 468b5e95b48SJohn Johansen mask |= MAY_READ; 469b5e95b48SJohn Johansen /* 470b5e95b48SJohn Johansen * Private mappings don't require write perms since they don't 471b5e95b48SJohn Johansen * write back to the files 472b5e95b48SJohn Johansen */ 473b5e95b48SJohn Johansen if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE)) 474b5e95b48SJohn Johansen mask |= MAY_WRITE; 475b5e95b48SJohn Johansen if (prot & PROT_EXEC) 476b5e95b48SJohn Johansen mask |= AA_EXEC_MMAP; 477b5e95b48SJohn Johansen 478b5e95b48SJohn Johansen return common_file_perm(op, file, mask); 479b5e95b48SJohn Johansen } 480b5e95b48SJohn Johansen 481e5467859SAl Viro static int apparmor_mmap_file(struct file *file, unsigned long reqprot, 482e5467859SAl Viro unsigned long prot, unsigned long flags) 483b5e95b48SJohn Johansen { 484b5e95b48SJohn Johansen return common_mmap(OP_FMMAP, file, prot, flags); 485b5e95b48SJohn Johansen } 486b5e95b48SJohn Johansen 487b5e95b48SJohn Johansen static int apparmor_file_mprotect(struct vm_area_struct *vma, 488b5e95b48SJohn Johansen unsigned long reqprot, unsigned long prot) 489b5e95b48SJohn Johansen { 490b5e95b48SJohn Johansen return common_mmap(OP_FMPROT, vma->vm_file, prot, 491b5e95b48SJohn Johansen !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0); 492b5e95b48SJohn Johansen } 493b5e95b48SJohn Johansen 494b5e95b48SJohn Johansen static int apparmor_getprocattr(struct task_struct *task, char *name, 495b5e95b48SJohn Johansen char **value) 496b5e95b48SJohn Johansen { 497b5e95b48SJohn Johansen int error = -ENOENT; 498b5e95b48SJohn Johansen /* released below */ 499b5e95b48SJohn Johansen const struct cred *cred = get_task_cred(task); 500214beacaSJohn Johansen struct aa_task_cxt *cxt = cred_cxt(cred); 50177b071b3SJohn Johansen struct aa_profile *profile = NULL; 502b5e95b48SJohn Johansen 503b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) 50477b071b3SJohn Johansen profile = aa_get_newest_profile(cxt->profile); 505b5e95b48SJohn Johansen else if (strcmp(name, "prev") == 0 && cxt->previous) 50677b071b3SJohn Johansen profile = aa_get_newest_profile(cxt->previous); 507b5e95b48SJohn Johansen else if (strcmp(name, "exec") == 0 && cxt->onexec) 50877b071b3SJohn Johansen profile = aa_get_newest_profile(cxt->onexec); 509b5e95b48SJohn Johansen else 510b5e95b48SJohn Johansen error = -EINVAL; 511b5e95b48SJohn Johansen 51277b071b3SJohn Johansen if (profile) 51377b071b3SJohn Johansen error = aa_getprocattr(profile, value); 51477b071b3SJohn Johansen 51577b071b3SJohn Johansen aa_put_profile(profile); 516b5e95b48SJohn Johansen put_cred(cred); 517b5e95b48SJohn Johansen 518b5e95b48SJohn Johansen return error; 519b5e95b48SJohn Johansen } 520b5e95b48SJohn Johansen 521b5e95b48SJohn Johansen static int apparmor_setprocattr(struct task_struct *task, char *name, 522b5e95b48SJohn Johansen void *value, size_t size) 523b5e95b48SJohn Johansen { 5243eea57c2SJohn Johansen struct common_audit_data sa; 5253eea57c2SJohn Johansen struct apparmor_audit_data aad = {0,}; 526b5e95b48SJohn Johansen char *command, *args = value; 527b5e95b48SJohn Johansen size_t arg_size; 528b5e95b48SJohn Johansen int error; 529b5e95b48SJohn Johansen 530b5e95b48SJohn Johansen if (size == 0) 531b5e95b48SJohn Johansen return -EINVAL; 532b5e95b48SJohn Johansen /* args points to a PAGE_SIZE buffer, AppArmor requires that 533b5e95b48SJohn Johansen * the buffer must be null terminated or have size <= PAGE_SIZE -1 534b5e95b48SJohn Johansen * so that AppArmor can null terminate them 535b5e95b48SJohn Johansen */ 536b5e95b48SJohn Johansen if (args[size - 1] != '\0') { 537b5e95b48SJohn Johansen if (size == PAGE_SIZE) 538b5e95b48SJohn Johansen return -EINVAL; 539b5e95b48SJohn Johansen args[size] = '\0'; 540b5e95b48SJohn Johansen } 541b5e95b48SJohn Johansen 542b5e95b48SJohn Johansen /* task can only write its own attributes */ 543b5e95b48SJohn Johansen if (current != task) 544b5e95b48SJohn Johansen return -EACCES; 545b5e95b48SJohn Johansen 546b5e95b48SJohn Johansen args = value; 547b5e95b48SJohn Johansen args = strim(args); 548b5e95b48SJohn Johansen command = strsep(&args, " "); 549b5e95b48SJohn Johansen if (!args) 550b5e95b48SJohn Johansen return -EINVAL; 551b5e95b48SJohn Johansen args = skip_spaces(args); 552b5e95b48SJohn Johansen if (!*args) 553b5e95b48SJohn Johansen return -EINVAL; 554b5e95b48SJohn Johansen 555b5e95b48SJohn Johansen arg_size = size - (args - (char *) value); 556b5e95b48SJohn Johansen if (strcmp(name, "current") == 0) { 557b5e95b48SJohn Johansen if (strcmp(command, "changehat") == 0) { 558b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 559b5e95b48SJohn Johansen !AA_DO_TEST); 560b5e95b48SJohn Johansen } else if (strcmp(command, "permhat") == 0) { 561b5e95b48SJohn Johansen error = aa_setprocattr_changehat(args, arg_size, 562b5e95b48SJohn Johansen AA_DO_TEST); 563b5e95b48SJohn Johansen } else if (strcmp(command, "changeprofile") == 0) { 564b5e95b48SJohn Johansen error = aa_setprocattr_changeprofile(args, !AA_ONEXEC, 565b5e95b48SJohn Johansen !AA_DO_TEST); 566b5e95b48SJohn Johansen } else if (strcmp(command, "permprofile") == 0) { 567b5e95b48SJohn Johansen error = aa_setprocattr_changeprofile(args, !AA_ONEXEC, 568b5e95b48SJohn Johansen AA_DO_TEST); 5693eea57c2SJohn Johansen } else 5703eea57c2SJohn Johansen goto fail; 571b5e95b48SJohn Johansen } else if (strcmp(name, "exec") == 0) { 5723eea57c2SJohn Johansen if (strcmp(command, "exec") == 0) 573b5e95b48SJohn Johansen error = aa_setprocattr_changeprofile(args, AA_ONEXEC, 574b5e95b48SJohn Johansen !AA_DO_TEST); 5753eea57c2SJohn Johansen else 5763eea57c2SJohn Johansen goto fail; 5773eea57c2SJohn Johansen } else 578b5e95b48SJohn Johansen /* only support the "current" and "exec" process attributes */ 579b5e95b48SJohn Johansen return -EINVAL; 5803eea57c2SJohn Johansen 581b5e95b48SJohn Johansen if (!error) 582b5e95b48SJohn Johansen error = size; 583b5e95b48SJohn Johansen return error; 5843eea57c2SJohn Johansen 5853eea57c2SJohn Johansen fail: 5863eea57c2SJohn Johansen sa.type = LSM_AUDIT_DATA_NONE; 5873eea57c2SJohn Johansen sa.aad = &aad; 5883eea57c2SJohn Johansen aad.profile = aa_current_profile(); 5893eea57c2SJohn Johansen aad.op = OP_SETPROCATTR; 5903eea57c2SJohn Johansen aad.info = name; 5913eea57c2SJohn Johansen aad.error = -EINVAL; 5923eea57c2SJohn Johansen aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL); 5933eea57c2SJohn Johansen return -EINVAL; 594b5e95b48SJohn Johansen } 595b5e95b48SJohn Johansen 5967cb4dc9fSJiri Slaby static int apparmor_task_setrlimit(struct task_struct *task, 5977cb4dc9fSJiri Slaby unsigned int resource, struct rlimit *new_rlim) 598b5e95b48SJohn Johansen { 5991780f2d3SJohn Johansen struct aa_profile *profile = __aa_current_profile(); 600b5e95b48SJohn Johansen int error = 0; 601b5e95b48SJohn Johansen 602b5e95b48SJohn Johansen if (!unconfined(profile)) 6033a2dc838SJohn Johansen error = aa_task_setrlimit(profile, task, resource, new_rlim); 604b5e95b48SJohn Johansen 605b5e95b48SJohn Johansen return error; 606b5e95b48SJohn Johansen } 607b5e95b48SJohn Johansen 608b1d9e6b0SCasey Schaufler static struct security_hook_list apparmor_hooks[] = { 609e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), 610e20b043aSCasey Schaufler LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), 611e20b043aSCasey Schaufler LSM_HOOK_INIT(capget, apparmor_capget), 612e20b043aSCasey Schaufler LSM_HOOK_INIT(capable, apparmor_capable), 613b5e95b48SJohn Johansen 614e20b043aSCasey Schaufler LSM_HOOK_INIT(path_link, apparmor_path_link), 615e20b043aSCasey Schaufler LSM_HOOK_INIT(path_unlink, apparmor_path_unlink), 616e20b043aSCasey Schaufler LSM_HOOK_INIT(path_symlink, apparmor_path_symlink), 617e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir), 618e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir), 619e20b043aSCasey Schaufler LSM_HOOK_INIT(path_mknod, apparmor_path_mknod), 620e20b043aSCasey Schaufler LSM_HOOK_INIT(path_rename, apparmor_path_rename), 621e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chmod, apparmor_path_chmod), 622e20b043aSCasey Schaufler LSM_HOOK_INIT(path_chown, apparmor_path_chown), 623e20b043aSCasey Schaufler LSM_HOOK_INIT(path_truncate, apparmor_path_truncate), 624e20b043aSCasey Schaufler LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr), 625b5e95b48SJohn Johansen 626e20b043aSCasey Schaufler LSM_HOOK_INIT(file_open, apparmor_file_open), 627e20b043aSCasey Schaufler LSM_HOOK_INIT(file_permission, apparmor_file_permission), 628e20b043aSCasey Schaufler LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security), 629e20b043aSCasey Schaufler LSM_HOOK_INIT(file_free_security, apparmor_file_free_security), 630e20b043aSCasey Schaufler LSM_HOOK_INIT(mmap_file, apparmor_mmap_file), 631e20b043aSCasey Schaufler LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect), 632e20b043aSCasey Schaufler LSM_HOOK_INIT(file_lock, apparmor_file_lock), 633b5e95b48SJohn Johansen 634e20b043aSCasey Schaufler LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), 635e20b043aSCasey Schaufler LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), 636b5e95b48SJohn Johansen 637e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank), 638e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_free, apparmor_cred_free), 639e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare), 640e20b043aSCasey Schaufler LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer), 641b5e95b48SJohn Johansen 642e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds), 643e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds), 644e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds), 645e20b043aSCasey Schaufler LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec), 646b5e95b48SJohn Johansen 647e20b043aSCasey Schaufler LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit), 648b5e95b48SJohn Johansen }; 649b5e95b48SJohn Johansen 650b5e95b48SJohn Johansen /* 651b5e95b48SJohn Johansen * AppArmor sysfs module parameters 652b5e95b48SJohn Johansen */ 653b5e95b48SJohn Johansen 654101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp); 655101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp); 656b8aa09fdSRusty Russell #define param_check_aabool param_check_bool 6579c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aabool = { 6586a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 659101d6c82SStephen Rothwell .set = param_set_aabool, 660101d6c82SStephen Rothwell .get = param_get_aabool 661101d6c82SStephen Rothwell }; 662b5e95b48SJohn Johansen 663101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp); 664101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp); 665b8aa09fdSRusty Russell #define param_check_aauint param_check_uint 6669c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aauint = { 667101d6c82SStephen Rothwell .set = param_set_aauint, 668101d6c82SStephen Rothwell .get = param_get_aauint 669101d6c82SStephen Rothwell }; 670b5e95b48SJohn Johansen 671101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp); 672101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp); 673b8aa09fdSRusty Russell #define param_check_aalockpolicy param_check_bool 6749c27847dSLuis R. Rodriguez static const struct kernel_param_ops param_ops_aalockpolicy = { 6756a4c2643SJani Nikula .flags = KERNEL_PARAM_OPS_FL_NOARG, 676101d6c82SStephen Rothwell .set = param_set_aalockpolicy, 677101d6c82SStephen Rothwell .get = param_get_aalockpolicy 678101d6c82SStephen Rothwell }; 679b5e95b48SJohn Johansen 680b5e95b48SJohn Johansen static int param_set_audit(const char *val, struct kernel_param *kp); 681b5e95b48SJohn Johansen static int param_get_audit(char *buffer, struct kernel_param *kp); 682b5e95b48SJohn Johansen 683b5e95b48SJohn Johansen static int param_set_mode(const char *val, struct kernel_param *kp); 684b5e95b48SJohn Johansen static int param_get_mode(char *buffer, struct kernel_param *kp); 685b5e95b48SJohn Johansen 686b5e95b48SJohn Johansen /* Flag values, also controllable via /sys/module/apparmor/parameters 687b5e95b48SJohn Johansen * We define special types as we want to do additional mediation. 688b5e95b48SJohn Johansen */ 689b5e95b48SJohn Johansen 690b5e95b48SJohn Johansen /* AppArmor global enforcement switch - complain, enforce, kill */ 691b5e95b48SJohn Johansen enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE; 692b5e95b48SJohn Johansen module_param_call(mode, param_set_mode, param_get_mode, 693b5e95b48SJohn Johansen &aa_g_profile_mode, S_IRUSR | S_IWUSR); 694b5e95b48SJohn Johansen 695b5e95b48SJohn Johansen /* Debug mode */ 69690ab5ee9SRusty Russell bool aa_g_debug; 697b5e95b48SJohn Johansen module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); 698b5e95b48SJohn Johansen 699b5e95b48SJohn Johansen /* Audit mode */ 700b5e95b48SJohn Johansen enum audit_mode aa_g_audit; 701b5e95b48SJohn Johansen module_param_call(audit, param_set_audit, param_get_audit, 702b5e95b48SJohn Johansen &aa_g_audit, S_IRUSR | S_IWUSR); 703b5e95b48SJohn Johansen 704b5e95b48SJohn Johansen /* Determines if audit header is included in audited messages. This 705b5e95b48SJohn Johansen * provides more context if the audit daemon is not running 706b5e95b48SJohn Johansen */ 70790ab5ee9SRusty Russell bool aa_g_audit_header = 1; 708b5e95b48SJohn Johansen module_param_named(audit_header, aa_g_audit_header, aabool, 709b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 710b5e95b48SJohn Johansen 711b5e95b48SJohn Johansen /* lock out loading/removal of policy 712b5e95b48SJohn Johansen * TODO: add in at boot loading of policy, which is the only way to 713b5e95b48SJohn Johansen * load policy, if lock_policy is set 714b5e95b48SJohn Johansen */ 71590ab5ee9SRusty Russell bool aa_g_lock_policy; 716b5e95b48SJohn Johansen module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy, 717b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 718b5e95b48SJohn Johansen 719b5e95b48SJohn Johansen /* Syscall logging mode */ 72090ab5ee9SRusty Russell bool aa_g_logsyscall; 721b5e95b48SJohn Johansen module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR); 722b5e95b48SJohn Johansen 723b5e95b48SJohn Johansen /* Maximum pathname length before accesses will start getting rejected */ 724b5e95b48SJohn Johansen unsigned int aa_g_path_max = 2 * PATH_MAX; 725b5e95b48SJohn Johansen module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR); 726b5e95b48SJohn Johansen 727b5e95b48SJohn Johansen /* Determines how paranoid loading of policy is and how much verification 728b5e95b48SJohn Johansen * on the loaded policy is done. 729b5e95b48SJohn Johansen */ 73090ab5ee9SRusty Russell bool aa_g_paranoid_load = 1; 731b5e95b48SJohn Johansen module_param_named(paranoid_load, aa_g_paranoid_load, aabool, 732b5e95b48SJohn Johansen S_IRUSR | S_IWUSR); 733b5e95b48SJohn Johansen 734b5e95b48SJohn Johansen /* Boot time disable flag */ 73590ab5ee9SRusty Russell static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE; 736c611616cSJohn Johansen module_param_named(enabled, apparmor_enabled, bool, S_IRUGO); 737b5e95b48SJohn Johansen 738b5e95b48SJohn Johansen static int __init apparmor_enabled_setup(char *str) 739b5e95b48SJohn Johansen { 740b5e95b48SJohn Johansen unsigned long enabled; 74129707b20SJingoo Han int error = kstrtoul(str, 0, &enabled); 742b5e95b48SJohn Johansen if (!error) 743b5e95b48SJohn Johansen apparmor_enabled = enabled ? 1 : 0; 744b5e95b48SJohn Johansen return 1; 745b5e95b48SJohn Johansen } 746b5e95b48SJohn Johansen 747b5e95b48SJohn Johansen __setup("apparmor=", apparmor_enabled_setup); 748b5e95b48SJohn Johansen 749b5e95b48SJohn Johansen /* set global flag turning off the ability to load policy */ 750101d6c82SStephen Rothwell static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp) 751b5e95b48SJohn Johansen { 752b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 753b5e95b48SJohn Johansen return -EPERM; 754b5e95b48SJohn Johansen if (aa_g_lock_policy) 755b5e95b48SJohn Johansen return -EACCES; 756b5e95b48SJohn Johansen return param_set_bool(val, kp); 757b5e95b48SJohn Johansen } 758b5e95b48SJohn Johansen 759101d6c82SStephen Rothwell static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp) 760b5e95b48SJohn Johansen { 761b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 762b5e95b48SJohn Johansen return -EPERM; 763b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 764b5e95b48SJohn Johansen } 765b5e95b48SJohn Johansen 766101d6c82SStephen Rothwell static int param_set_aabool(const char *val, const struct kernel_param *kp) 767b5e95b48SJohn Johansen { 768b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 769b5e95b48SJohn Johansen return -EPERM; 770b5e95b48SJohn Johansen return param_set_bool(val, kp); 771b5e95b48SJohn Johansen } 772b5e95b48SJohn Johansen 773101d6c82SStephen Rothwell static int param_get_aabool(char *buffer, const struct kernel_param *kp) 774b5e95b48SJohn Johansen { 775b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 776b5e95b48SJohn Johansen return -EPERM; 777b5e95b48SJohn Johansen return param_get_bool(buffer, kp); 778b5e95b48SJohn Johansen } 779b5e95b48SJohn Johansen 780101d6c82SStephen Rothwell static int param_set_aauint(const char *val, const struct kernel_param *kp) 781b5e95b48SJohn Johansen { 782b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 783b5e95b48SJohn Johansen return -EPERM; 784b5e95b48SJohn Johansen return param_set_uint(val, kp); 785b5e95b48SJohn Johansen } 786b5e95b48SJohn Johansen 787101d6c82SStephen Rothwell static int param_get_aauint(char *buffer, const struct kernel_param *kp) 788b5e95b48SJohn Johansen { 789b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 790b5e95b48SJohn Johansen return -EPERM; 791b5e95b48SJohn Johansen return param_get_uint(buffer, kp); 792b5e95b48SJohn Johansen } 793b5e95b48SJohn Johansen 794b5e95b48SJohn Johansen static int param_get_audit(char *buffer, struct kernel_param *kp) 795b5e95b48SJohn Johansen { 796b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 797b5e95b48SJohn Johansen return -EPERM; 798b5e95b48SJohn Johansen 799b5e95b48SJohn Johansen if (!apparmor_enabled) 800b5e95b48SJohn Johansen return -EINVAL; 801b5e95b48SJohn Johansen 802b5e95b48SJohn Johansen return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]); 803b5e95b48SJohn Johansen } 804b5e95b48SJohn Johansen 805b5e95b48SJohn Johansen static int param_set_audit(const char *val, struct kernel_param *kp) 806b5e95b48SJohn Johansen { 807b5e95b48SJohn Johansen int i; 808b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 809b5e95b48SJohn Johansen return -EPERM; 810b5e95b48SJohn Johansen 811b5e95b48SJohn Johansen if (!apparmor_enabled) 812b5e95b48SJohn Johansen return -EINVAL; 813b5e95b48SJohn Johansen 814b5e95b48SJohn Johansen if (!val) 815b5e95b48SJohn Johansen return -EINVAL; 816b5e95b48SJohn Johansen 817b5e95b48SJohn Johansen for (i = 0; i < AUDIT_MAX_INDEX; i++) { 818b5e95b48SJohn Johansen if (strcmp(val, audit_mode_names[i]) == 0) { 819b5e95b48SJohn Johansen aa_g_audit = i; 820b5e95b48SJohn Johansen return 0; 821b5e95b48SJohn Johansen } 822b5e95b48SJohn Johansen } 823b5e95b48SJohn Johansen 824b5e95b48SJohn Johansen return -EINVAL; 825b5e95b48SJohn Johansen } 826b5e95b48SJohn Johansen 827b5e95b48SJohn Johansen static int param_get_mode(char *buffer, struct kernel_param *kp) 828b5e95b48SJohn Johansen { 829b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 830b5e95b48SJohn Johansen return -EPERM; 831b5e95b48SJohn Johansen 832b5e95b48SJohn Johansen if (!apparmor_enabled) 833b5e95b48SJohn Johansen return -EINVAL; 834b5e95b48SJohn Johansen 8350d259f04SJohn Johansen return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]); 836b5e95b48SJohn Johansen } 837b5e95b48SJohn Johansen 838b5e95b48SJohn Johansen static int param_set_mode(const char *val, struct kernel_param *kp) 839b5e95b48SJohn Johansen { 840b5e95b48SJohn Johansen int i; 841b5e95b48SJohn Johansen if (!capable(CAP_MAC_ADMIN)) 842b5e95b48SJohn Johansen return -EPERM; 843b5e95b48SJohn Johansen 844b5e95b48SJohn Johansen if (!apparmor_enabled) 845b5e95b48SJohn Johansen return -EINVAL; 846b5e95b48SJohn Johansen 847b5e95b48SJohn Johansen if (!val) 848b5e95b48SJohn Johansen return -EINVAL; 849b5e95b48SJohn Johansen 8500d259f04SJohn Johansen for (i = 0; i < APPARMOR_MODE_NAMES_MAX_INDEX; i++) { 8510d259f04SJohn Johansen if (strcmp(val, aa_profile_mode_names[i]) == 0) { 852b5e95b48SJohn Johansen aa_g_profile_mode = i; 853b5e95b48SJohn Johansen return 0; 854b5e95b48SJohn Johansen } 855b5e95b48SJohn Johansen } 856b5e95b48SJohn Johansen 857b5e95b48SJohn Johansen return -EINVAL; 858b5e95b48SJohn Johansen } 859b5e95b48SJohn Johansen 860b5e95b48SJohn Johansen /* 861b5e95b48SJohn Johansen * AppArmor init functions 862b5e95b48SJohn Johansen */ 863b5e95b48SJohn Johansen 864b5e95b48SJohn Johansen /** 865b5e95b48SJohn Johansen * set_init_cxt - set a task context and profile on the first task. 866b5e95b48SJohn Johansen * 867b5e95b48SJohn Johansen * TODO: allow setting an alternate profile than unconfined 868b5e95b48SJohn Johansen */ 869b5e95b48SJohn Johansen static int __init set_init_cxt(void) 870b5e95b48SJohn Johansen { 871b5e95b48SJohn Johansen struct cred *cred = (struct cred *)current->real_cred; 872b5e95b48SJohn Johansen struct aa_task_cxt *cxt; 873b5e95b48SJohn Johansen 874b5e95b48SJohn Johansen cxt = aa_alloc_task_context(GFP_KERNEL); 875b5e95b48SJohn Johansen if (!cxt) 876b5e95b48SJohn Johansen return -ENOMEM; 877b5e95b48SJohn Johansen 878b5e95b48SJohn Johansen cxt->profile = aa_get_profile(root_ns->unconfined); 879214beacaSJohn Johansen cred_cxt(cred) = cxt; 880b5e95b48SJohn Johansen 881b5e95b48SJohn Johansen return 0; 882b5e95b48SJohn Johansen } 883b5e95b48SJohn Johansen 884b5e95b48SJohn Johansen static int __init apparmor_init(void) 885b5e95b48SJohn Johansen { 886b5e95b48SJohn Johansen int error; 887b5e95b48SJohn Johansen 888b1d9e6b0SCasey Schaufler if (!apparmor_enabled || !security_module_enable("apparmor")) { 889b5e95b48SJohn Johansen aa_info_message("AppArmor disabled by boot time parameter"); 890b5e95b48SJohn Johansen apparmor_enabled = 0; 891b5e95b48SJohn Johansen return 0; 892b5e95b48SJohn Johansen } 893b5e95b48SJohn Johansen 894b5e95b48SJohn Johansen error = aa_alloc_root_ns(); 895b5e95b48SJohn Johansen if (error) { 896b5e95b48SJohn Johansen AA_ERROR("Unable to allocate default profile namespace\n"); 897b5e95b48SJohn Johansen goto alloc_out; 898b5e95b48SJohn Johansen } 899b5e95b48SJohn Johansen 900b5e95b48SJohn Johansen error = set_init_cxt(); 901b5e95b48SJohn Johansen if (error) { 902b5e95b48SJohn Johansen AA_ERROR("Failed to set context on init task\n"); 903b1d9e6b0SCasey Schaufler aa_free_root_ns(); 904b1d9e6b0SCasey Schaufler goto alloc_out; 905b5e95b48SJohn Johansen } 906b1d9e6b0SCasey Schaufler security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks)); 907b5e95b48SJohn Johansen 908b5e95b48SJohn Johansen /* Report that AppArmor successfully initialized */ 909b5e95b48SJohn Johansen apparmor_initialized = 1; 910b5e95b48SJohn Johansen if (aa_g_profile_mode == APPARMOR_COMPLAIN) 911b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: complain mode enabled"); 912b5e95b48SJohn Johansen else if (aa_g_profile_mode == APPARMOR_KILL) 913b5e95b48SJohn Johansen aa_info_message("AppArmor initialized: kill mode enabled"); 914b5e95b48SJohn Johansen else 915b5e95b48SJohn Johansen aa_info_message("AppArmor initialized"); 916b5e95b48SJohn Johansen 917b5e95b48SJohn Johansen return error; 918b5e95b48SJohn Johansen 919b5e95b48SJohn Johansen alloc_out: 920b5e95b48SJohn Johansen aa_destroy_aafs(); 921b5e95b48SJohn Johansen 922b5e95b48SJohn Johansen apparmor_enabled = 0; 923b5e95b48SJohn Johansen return error; 924b5e95b48SJohn Johansen } 925b5e95b48SJohn Johansen 926b5e95b48SJohn Johansen security_initcall(apparmor_init); 927